{\rtf1\ansi\ansicpg1252\uc1 \deff1\deflang1033\deflangfe1033{\fonttbl{\f0\froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}
{\f3\froman\fcharset2\fprq2{\*\panose 05050102010706020507}Symbol;}{\f16\froman\fcharset238\fprq2 Times New Roman CE;}{\f17\froman\fcharset204\fprq2 Times New Roman Cyr;}{\f19\froman\fcharset161\fprq2 Times New Roman Greek;}
{\f20\froman\fcharset162\fprq2 Times New Roman Tur;}{\f21\froman\fcharset186\fprq2 Times New Roman Baltic;}{\f22\fswiss\fcharset238\fprq2 Arial CE;}{\f23\fswiss\fcharset204\fprq2 Arial Cyr;}{\f25\fswiss\fcharset161\fprq2 Arial Greek;}
{\f26\fswiss\fcharset162\fprq2 Arial Tur;}{\f27\fswiss\fcharset186\fprq2 Arial Baltic;}}{\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;
\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\stylesheet{
\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid \snext0 Normal;}{\s1\sb240\sa60\keepn\nowidctlpar\widctlpar\adjustright \b\f1\fs40\cf2\kerning28\cgrid \sbasedon0 \snext0 heading 1;}{\*\cs10 \additive Default Paragraph Font;}{
\s15\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid \sbasedon0 \snext15 footnote text;}{\*\cs16 \additive \super \sbasedon10 footnote reference;}}{\*\listtable{\list\listtemplateid67698689\listsimple{\listlevel\levelnfc23\leveljc0\levelfollow0
\levelstartat1\levelspace0\levelindent0{\leveltext\'01\u-3913 ?;}{\levelnumbers;}\f3\fbias0 \fi-360\li360\jclisttab\tx360 }{\listname ;}\listid1561359955}}{\*\listoverridetable{\listoverride\listid1561359955\listoverridecount0\ls1}}{\info{\title Welcome}
{\author Olly}{\operator Olly}{\creatim\yr2002\mo10\dy20\hr20\min24}{\revtim\yr2004\mo6\dy6\hr16\min33}{\version5}{\edmins19}{\nofpages4}{\nofwords728}{\nofchars4155}{\*\company  }{\nofcharsws0}{\vern71}}
\widowctrl\ftnbj\aenddoc\hyphcaps0\formshade\viewkind4\viewscale100\pgbrdrhead\pgbrdrfoot \fet0\sectd \linex0\endnhere\sectdefaultcl {\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl2\pnucltr\pnstart1\pnindent720\pnhang{\pntxta .}}
{\*\pnseclvl3\pndec\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang{\pntxta )}}{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang{\pntxtb (}
{\pntxta )}}{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta )}}\pard\plain 
\s1\sb240\sa60\keepn\nowidctlpar\widctlpar\outlinelevel0\adjustright \b\f1\fs40\cf2\kerning28\cgrid {\cs16\super #{\footnote \pard\plain \s15\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {\cs16\super #}{ Preliminary description}}${\footnote 
\pard\plain \s15\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {\cs16\super $}{ Preliminary description}}K{\footnote \pard\plain \s15\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {\cs16\super K}{ Preliminary description}}}{Command line plugin

\par }\pard\plain \nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {Welcome. I'm glad to present you the command line plugin, with very limited capabilities but completely functional. Its source code is free, so you can }{\uldb add any commands}{\v How to add
}{ and modify functionality of existing. Plugin uses new OllyDbg functions described in details in the PDK 1.10. Note that plugin does not work with any OllyDbg version prior to 1.08.
\par 
\par Shortcut for command line plugin: }{\b Alt+F1}{. Currently, it supports following commands:
\par 
\par }\trowd \trgaph108\trleft142\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr
\brdrs\brdrw10 \cltxlrtb \cellx3261\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb \cellx8931\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Expressions\cell }{\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\trowd \trgaph108\trleft142\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl
\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb \cellx3261\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb \cellx8931\pard \nowidctlpar\widctlpar\intbl\adjustright {
CALC expression\cell Calculate value of expression\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {? expression\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {expression }{\cf15 (first character is not letter)}{\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {WATCH expression\cell Add watch\cell 
}\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {W expression\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Assignments\cell }{\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {SET reg=expression\cell 
Writes value of expression to 8-, 16- or 32-bit general register\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {reg=expression\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {
\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {SET memory=expression\cell Writes value of expression to 8-, 16- or 32-bit memory\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell 
\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Disassembler\cell }{\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {AT expression
\cell Follow address in Disassembler\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {FOLLOW expression\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {ORIG\cell Go to actual EIP\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {*\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row 
}\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Dump and stack\cell }{\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row 
}\pard \nowidctlpar\widctlpar\intbl\adjustright {D expression\cell Follow address in dump\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {DUMP expression\cell Ditto\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {DA [expression]\cell Dump in assembler format\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {
DB [expression]\cell Dump in hex byte format\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {DC [expression]\cell Dump as ASCII text\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row 
}\pard \nowidctlpar\widctlpar\intbl\adjustright {DD [expression]\cell Dump as addresses (stack format)\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {DU [expression]\cell Dump as UNICODE text
\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {DW [expression]\cell Dump in hex word format\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {STK expression\cell Follow address in stack\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {
\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Assembling\cell }{\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {A expression [,command]\cell Assemble at address\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Labels and comments\cell }{\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {L expression, label\cell Assign symbolic label to address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {C expression, comment\cell Set comment at address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Breakpoint commands\cell }{\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {
BP expression [,condition]\cell Set INT3 breakpoint at address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {BPX label\cell 
Set breakpoint on each call to external 'label' within the current module\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {BC expression\cell Delete breakpoint at address\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {MR expression1 [,expression2]\cell Set memory breakpoint on access to range\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {MW expression1 [,expression2]\cell Set memory breakpoint on write to range\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {MD\cell 
Remove memory breakpoint\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {HR expression\cell Set 1-byte hardware breakpoint on access to address\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {HW expression\cell Set 1-byte hardware breakpoint on write to address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {HE expression\cell Set hardware breakpoint on execute at address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {HD [expression]\cell 
Remove hardware breakpoint(s) at address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\b Tracing commands\cell }{\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {STOP\cell Pause execution\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {PAUSE\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {RUN\cell Run program\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {G [expression]\cell Run till address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {
GE [expression]\cell Pass exception to handler and run till address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {S\cell Step into\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row 
}\pard \nowidctlpar\widctlpar\intbl\adjustright {SI\cell Ditto\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {SO\cell Step over\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {T [expression]\cell Trace in till address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {TI [expression]\cell Ditto\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {TO [expression]\cell Trace over till address\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {
TC condition\cell Trace in till condition\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {TOC condition\cell Trace over till condition\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row 
}\pard \nowidctlpar\widctlpar\intbl\adjustright {TR\cell Execute till return\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {TU\cell Execute till user code\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b OllyDbg windows\cell }{\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {LOG\cell View Log window\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {MOD\cell 
View Executable modules\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {MEM\cell View Memory window\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {CPU\cell View CPU window\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {CS\cell View Call Stack\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {
\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {BRK\cell View Breakpoints window\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {OPT\cell Edit options\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\cell \cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {\b Miscellaneous commands\cell }{\cell 
}\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {EXIT\cell Close OllyDbg\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {QUIT\cell Ditto
\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {OPEN [filename]\cell Open executable file for debugging\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {CLOSE\cell Close debugged program\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {RST\cell Restart current program\cell }\pard 
\nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {HELP\cell Show help on command line plugin\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\intbl\adjustright {
HELP OllyDbg\cell Show OllyDbg help\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\trowd \trgaph108\trleft142\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv
\brdrs\brdrw10 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb \cellx3261\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb 
\cellx8931\pard \nowidctlpar\widctlpar\intbl\adjustright {HELP APIfunction\cell Show help on API function\cell }\pard \nowidctlpar\widctlpar\intbl\adjustright {\row }\pard \nowidctlpar\widctlpar\adjustright {
\par Commands are not case-sensitive, parameters in brackets are optional. Expressions may include constants, registers and memory references and support all standard arithmetical and boolean functions. By default, all constants are hexadecimal. To mark consta
nt as decimal, follow it with decimal point. Examples:
\par 
\par {\pntext\pard\plain\f3\fs20\cgrid \loch\af3\dbch\af0\hich\f3 \'b7\tab}}\pard \fi-360\li360\nowidctlpar\widctlpar\jclisttab\tx360{\*\pn \pnlvlblt\ilvl0\ls1\pnrnot0\pnf3\pnstart1\pnindent360\pnhang{\pntxtb \'b7}}\ls1\adjustright {\b 2+2}{
 - calculate value of this expression;
\par {\pntext\pard\plain\f3\fs20\cgrid \loch\af3\dbch\af0\hich\f3 \'b7\tab}}\pard \fi-360\li360\nowidctlpar\widctlpar\jclisttab\tx360{\*\pn \pnlvlblt\ilvl0\ls1\pnrnot0\pnf3\pnstart1\pnindent360\pnhang{\pntxtb \'b7}}\ls1\adjustright {\b AT [EAX+10]}{
 - disassemble at address that is the contents of memory doubleword at address EAX+0x10;
\par {\pntext\pard\plain\f3\fs20\cgrid \loch\af3\dbch\af0\hich\f3 \'b7\tab}}\pard \fi-360\li360\nowidctlpar\widctlpar\jclisttab\tx360{\*\pn \pnlvlblt\ilvl0\ls1\pnrnot0\pnf3\pnstart1\pnindent360\pnhang{\pntxtb \'b7}}\ls1\adjustright {\b 
BP KERNEL32.GetProcAddress}{ - set breakpoint on API function. Note that you can set breakpoint in system DLL only in NT-based operating systems;
\par {\pntext\pard\plain\f3\fs20\cgrid \loch\af3\dbch\af0\hich\f3 \'b7\tab}}\pard \fi-360\li360\nowidctlpar\widctlpar\jclisttab\tx360{\*\pn \pnlvlblt\ilvl0\ls1\pnrnot0\pnf3\pnstart1\pnindent360\pnhang{\pntxtb \'b7}}\ls1\adjustright {\b BPX GetProcAddress}{
 - set breakpoint on every call to external function GetProcAddress in the currently selected module;
\par {\pntext\pard\plain\f3\fs20\cgrid \loch\af3\dbch\af0\hich\f3 \'b7\tab}}\pard \fi-360\li360\nowidctlpar\widctlpar\jclisttab\tx360{\*\pn \pnlvlblt\ilvl0\ls1\pnrnot0\pnf3\pnstart1\pnindent360\pnhang{\pntxtb \'b7}}\ls1\adjustright {\b BP 412010,EAX==WM_CLOSE}
{ - set conditional breakpoint at address 0x412010. Program pauses when EAX is equal to WM_CLOSE.
\par }\pard \nowidctlpar\widctlpar\adjustright {
\par You can find full description of expressions supported by OllyDbg in the OllyDbg help.
\par }\pard\plain \s1\sb240\sa60\keepn\nowidctlpar\widctlpar\outlinelevel0\adjustright \b\f1\fs40\cf2\kerning28\cgrid {\page }{\cs16\super #{\footnote \pard\plain \s15\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {\cs16\super #}{ How to add}}${\footnote 
\pard\plain \s15\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {\cs16\super $}{ How to add}}K{\footnote \pard\plain \s15\nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {\cs16\super K}{ How to add}}}{How to add new command
\par }\pard\plain \nowidctlpar\widctlpar\adjustright \f1\fs20\cgrid {To add new command, first you must register it in the array }{\cf2 cmdlist[]}{
. Elements of this array are structures of type t_command. First element is the command in uppercase, second element describes its operands. Current version of plugin supports only three types of operands:
\par }\pard \li432\nowidctlpar\widctlpar\adjustright {
\par A - address expression with value in }{\cf2 address}{. Plugin checks that it points to allocated memory.
\par a - same as A but optional. If expression is absent, }{\cf2 address}{ is set to 0.
\par 
\par V - expression of any type in }{\cf2 value}{. If you expect integer expression, check that }{\cf2 value.dtype}{ is DEC_DWORD and use contents of }{\cf2 value.u}{.
\par v - same as V but optional. If expression is absent, }{\cf2 value.dtype}{ is DEC_UNKNOWN and }{\cf2 value.u}{ is 0.
\par 
\par S - ASCII string in }{\cf2 string}{, may be empty.
\par }\pard \nowidctlpar\widctlpar\adjustright {
\par Third element is a constant that will be passed to command procedure, and the fourth one is the address of procedure that executes the command:
\par 
\par }\pard \li432\nowidctlpar\widctlpar\adjustright {\cf2 typedef int t_exefunc(char *answer,ulong parm);
\par }\pard \nowidctlpar\widctlpar\adjustright {
\par If all operands of the recognized command are parsed and estimated correctly, plugin calls this procedure. First argument, }{\cf2 answer}{
, is the pointer to string 256 bytes long. Its contents will be displayed in the command line window after command is executed. Second argument is the parameter from }{\cf2 cmdlsit[]}{
. If function returns 0, command is considered correct and will be added to the history list.
\par 
\par }}